Step 2 · Inventory
Asset inventory What you protect and what it depends on.
The inventory lists services, information, systems, premises and providers – with owners and dependencies. Without it, every risk assessment stays generic.
What it is about
ISO/IEC 27001 Annex A 5.9 provides for an inventory of information and other associated assets, including owners. The BSI Act names the management of ICT systems, products and processes in Section 30(2) No. 9. What matters is not the length of the list but knowing which service depends on which system and which provider.
- Service
- System
- Data
- Supplier
Sample values
How to go about it
- 01
Start with services, not hardware.
- 02
For each service, record systems, data, premises and providers.
- 03
Assign owners and criticality.
- 04
Update the inventory with every change.
Common mistakes
- The inventory is a hardware list from accounting.
- Cloud and SaaS services are missing.
- Nobody owns the entries.
What an auditor wants to see
- Current inventory with owners
- Dependency overview for critical services
- Evidence of regular maintenance
How UniqSuite helps
UniqSuite shows the dependencies between services, systems and providers as an overview. You then assess critical providers in the supplier check.
References
- ISO/IEC 27001, Annex A 5.9 and 5.10
- ISO/IEC 27001, Annex A 5.12: classification of information
- Section 30(2) No. 9 BSIG
Frequently asked questions
How detailed must the inventory be?
Detailed enough to assess risks per service. To start, the most important services and everything they depend on are enough.
Do cloud services belong in it?
Yes. A SaaS service holding your data is an asset like any server – with a provider and a contract.
Does information have to be classified?
In almost all cases, yes. Annex A 5.12 provides for information to be classified according to confidentiality, integrity, availability and relevant interested party requirements. Excluding it needs a justification in the Statement of Applicability. The classification belongs in the inventory as an attribute.
What happens to assets when someone leaves?
They are returned. Annex A 5.11 provides for this upon change or termination of employment, contract or agreement. The inventory shows what has to be returned.
Do we need a special tool?
No, the standard does not prescribe one. To start, a well-maintained spreadsheet is enough, as long as owners, dependencies and changes are traceable.
See what this looks like in UniqSuite.
In half an hour we walk you through it with your own questions.